CVE-2026-55245: CWE-918: Server-Side Request Forgery (SSRF) in maximhq bifrost

The vulnerability in maximhq bifrost affects versions prior to 1.5.17 in the isPublicIP function located in core/providers/utils/fetch.go. This function incorrectly treats Carrier-Grade NAT (100.64.0.0/10), IPv6 6to4 (2002::/16), NAT64 (64:ff9b::/96 and 64:ff9b:1::/48), and deprecated IPv6 site-local (fec0::/10) addresses as public. Because of this, an attacker who controls a multimodal request URL can exploit the FetchAndEncodeURL function used for Bedrock and Vertex image or document URLs to induce the gateway to fetch internal network services, including sensitive cloud instance metadata endpoints encoded through 6to4 or NAT64. This SSRF vulnerability enables unauthorized internal network access. The issue is resolved in bifrost version 1.5.17.

A remote attacker can exploit this SSRF vulnerability to make the bifrost gateway fetch internal services that should not be accessible externally, such as cloud instance metadata endpoints. This can lead to unauthorized information disclosure or further internal network attacks. The vulnerability does not require authentication or user interaction and has a high severity rating (CVSS 8.7).

This vulnerability is fixed in maximhq bifrost version 1.5.17. Users should upgrade to version 1.5.17 or later to remediate this issue. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory stating the fix is in 1.5.17.